Search

Helping developers and enterprises secure their code is what we do. Got a project, an RFP, or just some questions? Let us know!

info(at)matasano.com
1-888-677-0666 x0

Playbook is our product. It does firewall sync. To learn more about Playbook, check out the site, or get in touch with us via the web, e-mail, or phone.

playbook(at)matasano.com
1-888-677-0666 x7529 (PLAY)

« The Security Implications Of Google Native Client | Main | If You're Typing The Letters A-E-S Into Your Code, You're Doing It Wrong »
Thursday
Aug272009

Ruby For Pentesters - The Dark Side I: Ragweed

Last summer I was given the task of porting a Win32 Ruby scriptable debugger to OSX… a task I accomplished with some consternation.

Over the last year of working here at Matasano, I’ve had some time to refine the code enough for release. I’ve cleaned up a bunch of the code resulting from my inexperience with Ruby, implemented a couple features and fixed several bugs. Meanwhile, Chris Rohlf began a Linux port and its beginnings are included in the gem. And yes, Ragweed is now available as a gem through github. (sudo gem install tduehr-ragweed for the impatient with github as a gem source)

Why a scriptable debugger?

When reversing, the usual debugging tools for developers aren’t as useful. They’re built for stepping interactively through programs you have source code for. They don’t generally have methods to get data out.

Reversing also requires being able to do mean and nasty things to the running process. When tracing calls, you want to watch how they interact. The last thing you want to do is anything manual. Automation is a requirement.

Also helpful is the ability to automate information gathering tasks, or the ability to dynamically add, remove or change breakpoints. These features are why scriptable debuggers have been created: To play with black boxes in a more dynamic and seedier manner.

What’s available already?

There are already scriptable debuggers out there.  The most notable are PaiMei/PyDbg, Immunity Debugger and IDA.

PaiMei is written in Python, bills itself as “a reverse engineer’s swiss army knife” and uses the Python ctypes library for low level win32 calls.  

Immunity Debugger is a GUI debuggger for win32 that uses Python for its scripting functionality.  

IDA Pro is largely a win32 disassembler, but it is scriptable, again in Python, and includes a debugging module.

Before I get run off by a screaming mob with pitchforks, flightless birds, members of the family bovidae, etc., I will also mention GDB which has a library in development (libgdb) and can be scripted through macros.

With the exception of GDB which runs on most platforms and has its own macro language, these all share two common problems: Win32 and Python. Matasano is a Ruby shop. We like Ruby. It is good to us. We also wanted a tool for non-Win32 applications. But mostly, we just wanted something in Ruby.

Enter Ragweed

I’m going to stick to the OSX side of Ragweed for this article since I’m most familiar with it and there is still work to be done to unify the (currently) three debugging APIs —- Win32, Linux, and OSX —- inside Ragweed.

Under the hood, Ragweed (on OSX) uses Ruby/DL to perform the various low level system calls necessary to create a debugger. (More about that in my post from last year). These calls are abstracted somewhat to provide a smoother, more Ruby-like interface.

There are two caveats for Ragweed in OSX:

  • Due to the changes in Ruby 1.9 to DL, it is currently incompatible with 1.9.

  • Also, under OSX, Ragweed wants to run as root due to restrictions on task_for_pid.

A quick example (this we can do in IRB):

# debugging ftp using default signal handlers, printing registers every stop and logging calls to _lpwd

  require ‘ragweed’
  class DebugFtp < Debuggerosx

  # print the registers every time the process stops

    def on_stop(signal)

      puts "Stopped with signal #{signal}"

      self.threads.each {|t| self.get_registers(t).dump}

    end

  end

  # no process lookup by name yet

  d = DebugFtp.new(pid) # where pid is the id of ftp for this example

  # set breakpoint for lpwd

  d.breakpoint_set(0x420f,‘lpwd’, (bpl = lambda do | t, r, s | puts "#{ s.breakpoints[r.eip].first.function } hit in thread #{ t }\n"; end))

  d.install_breakpoints

  d.continue

  d.loop #loop until child exits

  # now go do stuff in in your other terminal window running ftp

That’s it. We just override the signal handlers for the signals we want to know about (or not), attach to a running process, set and install breakpoints, and it’s off to the traces. A simple hit tracer is only a CSV file and read loop away from this.

Want info on a region of memory?

d.region_info(0x0,:basic).dump

What about thread_info?

d.threadinfo(threadid).dump

Break stuff by playing with registers?

regs = d.get_registers(thread_id) regs.eip = 0x420f d.set_registers(thread_id, regs)

Grope through the child’s memory?

Ragweed::Wraposx::vm_read(d.task, address, size) #returns a string of child's memory

There you have it. It’s not pretty but it’s only begun.

References (80)

References allow you to track sources for this article, as well as articles that were written in response to this article.

Reader Comments (88)

Great information thanks want more information on..

Exercise to flatten stomach
... can you post...

March 12, 2010 | Unregistered CommenterStomach fat exercises

Juicy clothes
Buy full line Juicy couture products from our site at a low price to make yourself a fashionista! Dress juicy couture clothing, holding juicy couture
Shop prom dresses, formal dresses, prom shoes, 2010 designer prom gowns at dres4sale.
for cocktail dresses, dresses for prom, homecoming dresses, and evening dresses. Cheap prom dresses or couture designer evening gowns for your next formal.
evening dresses
Evening Dresses. Women's Formal & Special Occasion Dresses ... Welcome to Cheap Evening Dresses for Sale! ... Buy Cheap Evening Dresses Sales & Accessories
prom dresses

March 20, 2010 | Unregistered Commenterasdasd

Yes.. whenever i use these type of script, justconfused... but managed...

Paloma Water Heater

March 20, 2010 | Unregistered CommenterGuns

This is so good to use. I think this is definitely the future. I think this needs to be pushed more in technology.
qui tam lawyers los angeles

April 22, 2010 | Unregistered Commenterjames lee

There are two caveats for Ragweed in OSX:

*

Due to the changes in Ruby 1.9 to DL, it is currently incompatible with 1.9.
*

Also, under OSX, Ragweed wants to run as root due to restrictions on task_for_pid.

Logo Design | Logo Designs | Business Logo | Website Design

April 29, 2010 | Unregistered Commenterlogo design

Wonderful information. I will go to share this to my friends...

Email Database

May 7, 2010 | Unregistered CommenterSaguntha

P90x .It really is not expensive if you factor in the cost

of a gym membership,P90x workout . The cost for P90X is

about three months of a paid gym membership but you get to

keep the program foreverP90x . You can try many of the

online sites, but it will be the same as buying from the

company or a Beachbody Coach. Make sure you are getting

original DVD's. People are selling copies all over. The

problem is how long will they last, P90x workout ,and you

truly need the exercise and nutrition guide to even follow

the program. You can go to any site

http://www.p90xmall.com/ or you can go to and click on

products. P90x dvd You can order directly from the

site,P90x dvd.

May 8, 2010 | Unregistered Commenterp90x

I like this post very much. I will go to share this in my twitter page...

Products Review and Price.

May 15, 2010 | Unregistered CommenterSivam

Hey, I am checking this site from my Blackberry and it looks kinda funky. Thought you’d want to know. It’s a great post though, didn’t mess that up

Portable Air Conditioning Unit
Business week MBA
jazz music download
Email Database
double oven electric range
microwave rice cooker
Hot News and Events
Products Review and Price

May 26, 2010 | Unregistered CommenterLp

Hey, I am checking this site from my Blackberry and it looks kinda funky. Thought you’d want to know. It’s a great post though, didn’t mess that up

Small Corner Computer Desk
Cheap Life Assurance Quote
Dolce and Gabbana Sunglasses
Female Hair Transplant
Hair Loss Solutions
Disney Minnie Mouse

May 30, 2010 | Unregistered CommenterSK

Provide high quality silver Tiffany jewellery including necklaces,rings and other style jewelry at wholesale prices.Pick your dreaming
Tiffany jewellery
Tiffany co
Tiffany
Tiffany Stores is the best online United Kingdom jewelry stores where you can buy the cheapest Tiffany & Co silver jewelry.
Our huge selection of Tiffany
Tiffany & Co Rings
Tiffany & Co Earrings
Tiffany & Co Bracelets
Buy cartier ring, cartier love on abcartier.com. We also provide cartier bracelet, cartier jewelry and so on. Now come on and get what you want.
Cartier Jewelry
Cartier jewellery

May 31, 2010 | Unregistered Commenterharry123

The article written by your very good, I like it very much. I will keep your new article.
rosetta stone spanish,
rosetta stone,
rosetta stone language.

June 6, 2010 | Unregistered Commenterrosetta

i need to ask one thing whenever i put the word end in the coding they said error found why is it so?

June 17, 2010 | Unregistered CommenterDWI attorneys

i came across this language but didn't understand much, i hope this time i will get it through and make one IRB. Thanks

June 21, 2010 | Unregistered Commenterinternet via satellite

I came across this language but didn't understand much, i hope this time i will get it through and make one IRB. Thanks internet via satellite

June 21, 2010 | Unregistered Commenterinternet via satellite

This is my first time i visit here. I provide web hosting in pakistan & also i write essays for custom essay writing I found so many interesting stuff in your blog especially its discussion. i also have a website at: business card printing
and i also give news updates pakistan I
guess I am not the only one having all the enjoyment here!
keep up the good work.
Many Thanks!

web hosting pakistan | domain hosting pakistan | web hosting in pakistan | download free software | news updates pakistan | news updates pakistan | custom essay writing | apa paper writing | business card printing | panaflex printing | stationery printing | seo training in karachi | seo services | seo expert | printing services pakistan | embroidery punching | embroidery digitizers | custom digitizing | custom essay writing uk | english to urdu translation

June 25, 2010 | Unregistered Commenteruk essay writing

People usually say :"Seeing is believing." GHD Each attempt has a corresponding gain, in part or obvious, or vague. At least we have the kind of satisfaction After I bought this watch ,in a sense,it means a great deal to me. net a porter thank you!it is very useful tools to protect our time.If you never pay attention to yourself ,please grasp this chance.a few days ago,I bought a Rolex watches.IT's very good to use.So i want to write an article about watches to share with everyone on So as to more and more people to konw it. UGG brand is relatively common, in addition to the Rolex ping g15even see watch on the movement and you don't know.
Rolex watches

June 25, 2010 | Unregistered Commenterrolex watches

You'll be just as cool as the girls walking through the halls of your local high schools, only difference is that most of them aren't carrying authentic vuitton replica . When you want something a little different but full of style, louis vuitton replica and genuine good taste in style, carry louis replica .

July 1, 2010 | Unregistered Commenterlouis vuitton

ED Hardy jeans and shirts are so stylish and flexible that it can be literally worn by almost everyone. The hardy shirts shirts and jeans are made of lightweight materials and every shirt has that unique and expressive print that captures the vintage look. These are so carefully conceptualized by the greatest tattoo artist of his time, hardy shirts . That simply confirms that the ideas and concepts embedded on the hardy shirt Clothing are rooted to the natural flair of its maker and founder for unique and meticulous designs.

The chanel watches vintage online collection is not demarcated as a separate collection as per catalogues since Chanel bags collection is only meant to give a broader choice and does not feature any new designs. It is meant for increasing the ease with which people can browse past Chanel bag and make it a better shopping experience. Chanel Wallet also allows customers to ask for their favored designs rather than the ones available in season.

July 5, 2010 | Unregistered Commenterlida daidaihua
Editor Permission Required
You must have editing permission for this entry in order to post comments.